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Abstract 

This article discusses opportunities and challenges of physical layer security integration in massive 
multiple-input multiple-output (MaMIMO) systems. Specifically, we first show that MaMIMO itself is 
robust against passive eavesdropping attacks. We then review a pilot contamination scheme which actively 
attacks the channel estimation process. This pilot contamination attack is not only dramatically reducing 
the achievable secrecy capacity but is also difficult to detect. We proceed by reviewing some methods from 
literature that detect active attacks on MaMIMO. The last part of the paper surveys the open research 
problems that we believe are the most important to address in the future and give a few promising 
directions of research to solve them. 
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I. Introduction 

During the recent past the field of massive multiple-input multiple-output (MaMIMO) systems has 
quickly emerged as one of the most promising techniques to boost the system throughput of emerging 
and future communication systems. In MaMIMO, the vision is to equip the base station (BS) with an 
antenna array comprising lOO-i- antenna elements and a large number of independent transceiver chains. 
An impressive amount of research on the topic has been conducted, and MaMIMO will be integrated 
in the upcoming 5G standard Ol, lO. The advantages of MaMIMO are manifold, and to give a few we 
mention (i) An array gain corresponding to the number of BS antenna elements, (ii) A channel hardening 
effect, rendering stable and predictable channel conditions to users, (iii) Nearly orthogonal channels from 
the BS to the users, (iv) Simple signal processing at both the BS and at the users. 

Another advantage of MaMIMO, yet not widely recognized, is that the potential of physical layer 
security (PLS) against passive eavesdropping attacks is increased dramatically. PLS is based on the 
following result: Consider a Gaussian wiretap channel ||3l where a BS communicates with a legitime 
user (LU) in the presence of a passive eavesdropper (ED). Assume that the Shannon capacities from the 
BS to the LU and the ED are Clu and CED^ respectively. Then, the secrecy capacity between the BS and 
the LU is Csc = maxICLu ~ Ced, 0}. This rate can be transmitted reliably and securely without any use 
of a formal crypto system. In conventional MIMO systems, the two capacities Clu and Ced are of similar 
order of magnitude, rendering a fairly small secrecy capacity. With MaMIMO and passive eavesdropping, 
the situation changes dramatically. With standard time-division duplex (TDD) mode MaMIMO operations, 
and due to (i) - (iii) above, the received signal power at the LU is several orders of magnitude larger 
than the received signal power at the ED. This generates a situation where the secrecy capacity is nearly 
the full capacity to the LU, i.e., Csc ~ Clu 0- Altogether, MaMIMO enables excellent PLS, without 
any extra effort. 

There are of course countermeasures that can be taken by the ED. Lirst of all, it could place itself 
physically close to the LU so that the channels to the LU and the ED are highly correlated. In this case, 
(iii) does not longer hold true, and the secrecy capacity may be compromised. Another effective strategy 
that the ED can adopt is to exploit the weakness of the channel estimation phase in MaMIMO. By 
switching from a passive to an active mode, the ED can pretend to be the LU and send a pilot sequence 
of his own - this is the so called pilot contamination attack. The BS will then beamform signal power to 
the ED instead of the LU. To detect such a stealthy attack is challenging since there is a normal amount 
of pilot contamination already present in MaMIMO systems. 


April 28, 2015 


DRAFT 


3 


Active ED attacks are by no means unique to MaMIMO. On the contrary, jamming the BS is a well 
researched attack in conventional MIMO. See for example Q, 0 for two recent papers where the ED 
attacks the channel estimation phase. The ED can also combine passive eavesdropping and active jamming 
attacks. The strategies for countering such an attack in conventional MIMO channels are discussed in 
ifTll . A game-theoretic approach is taken in |8l to deal with combination of passive and active attacks. 
However, none of the aforementioned papers explicitly dealt with MaMIMO systems and the inefficiency 
of passive eavesdropping in MaMIMO was not observed. 

Although MaMIMO has received huge attention, the existing literature on the combination of PES 
and MaMIMO is scarce. This paper will survey the opportunities that MaMIMO may bring for making 
PES a reality, as well as discussing problems that must be tackled in the future. The paper sets off by 
discussing the benefits that MaMIMO brings to PES in the presence of a passive ED. We then highlight 
that active attacks are more likely to occur for MaMIMO. Three detection methods to deal with active 
attacks are then briefly reviewed. We then outline important open problems to address. The paper is 
concluded by a discussion of a few promising directions of future research. We believe that there are 
many interesting aspects of PES integration in MaMIMO to be researched and hope that this survey will 
attract the attention of the research community to this exciting and open field. 

II. Passive and Active Eavesdropping Attacks 

Eor conceptual simplicity, we consider a single cell with an M-antenna BS, one single-antenna EU, 
and one single-antenna ED. The uplink channels from the EU and the ED to the BS are denoted as gLu 
and gED> respectively. We assume a TDD system where channel reciprocity holds, and the corresponding 
downlink channels are gJu and Sed where denotes transpose operation. Standard TDD MaMIMO 
involves two phases: (i) The EU transmits a training symbol to the BS in the uplink, and (ii) Relying 
on channel reciprocity, the BS performs channel estimation and beamforms the signal to the EU in the 
downlink using the uplink channel estimation gu with proper scaling. 

The ED aims to overhear the communication from the BS to the EU while at the same time being 
undetected. To this end, the ED can launch either a passive attack or an active attack, which will be 
reviewed below. 

A. Passive Eavesdropping Attack 

Eet us now discuss the passive attack within a MaMIMO context as shown in Eig. [T] The key observation 
here is that the presence of a passive ED is not at all affecting the beamforming at the BS and has an 


April 28, 2015 


DRAFT 


4 


negligible effect on the secrecy capacity. Intuitively, this is because MaMIMO has the capability to focus 
the transmission energy in the direction of the LU. This implies that the received signal strength at the 
ED is much less than that at the LU. In Fig. [T] the resulting ergodic capacities Clu and Ced are shown 
as functions of the number of BS antennas M with perfect channel estimation. It is assumed that gLu 
and gED are independent and identically distributed (i.i.d) complex Gaussian vectors with equal mean 
powers, and the BS transmit power is normalized to 0 dB. 

As can be seen from Fig. [T] the ED’s capacity remains the same as M increases; this is so since the BS 
does not beamform in the ED’s direction. The capacity to the LU, however, is greatly increased for large 
values of M. In other words, the secrecy capacity is about half of the LU capacity with conventional 
MIMO (M Ri 2 — 8), while it constitutes more than 85% of Clu already at M = 100. From this simple 
example, we can see that MaMIMO has excellent potential for integration of PLS. 

B. An active attack on the channel estimation 

The resilience of MaMIMO against the passive attack is based on the assumption that the uplink 
channel estimation guu is independent of the ED’s channel gED- This motivates the ED to design active 
attacks on the channel estimation process to influence the BS’s beamforming design. Next we describe 
such an attack based on the pilot contamination scheme in ifTOl . 

As illustrated in Fig. during the uplink channel estimation, the LU transmits a pilot symbol to the 
BS. At the same time, the ED launches the attack by sending another pilot symbol. In the worst case 
the ED is synchronized with the legitimate transmission and this is possible by overhearing the signaling 
exchange between the BS and the LU. 

The consequence of this attack, if left undetected, is that the promising PLS benefits of MaMIMO are 
lost. The difference from the passive attack is that the channel estimate guu becomes correlated with the 
ED’s channel gED> and consequently the equivalent channel for the ED also improves as M increases. 
Even worse, if the ED uses higher training power, it dominates the training phase and the secrecy capacity 
may become zero. 

For the same settings as in Fig. 1, we plot the ergodic channel capacities and the ergodic secrecy 
capacity in Fig. The signal sent by the ED is lOdB weaker than the training signal sent by the LU. 
As can be seen, both the ED’s and the LU’s channel capacities increase with M, however, the secrecy 
capacity remains constant for M > 50. 

Although the situation is similar to the well-known pilot contamination problem in multi-cell systems 
(91, a notable difference is that the ED is out of control and therefore existing schemes for reducing pilot 
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contamination in MaMIMO cannot be applied. In the remainder of this paper we survey recent progress 
to detect the active attack and discuss possible future directions of research. 


III. Detection Schemes 


As described in Section II-B detection of an active ED is crucial for secure MaMIMO communication. 


Now we will present arguments that show how peculiar and different ED detection is in MaMIMO 
systems. 

Consider a detection scheme applied by the BS during uplink packet transmission, that is based on 
successful packet reception. In systems such as ETE and WEAN, the uplink packet contains channel 
estimation pilots. If the ED attacks these pilots, one could argue that this would result in decoding errors 
and thus packet loss (due to a bad channel estimate). Indeed, this is what happens in conventional MIMO 
systems with few antennas (depending on the robustness of the used modulation and coding scheme, 
of course). Therefore, the BS would suspect presence of strong interference, either coming from an ED 
or another user, and could take actions based on this. However, in MaMIMO, the erroneous channel 
estimate does not typically result in a decoding error, assuming that ED’s channel is uncorrelated with 
EU’s channel. Hence, in contrast to a conventional MIMO system, a successful packet reception does not 
imply absence of an ED in a MaMIMO system. As we have argued, if this erroneous channel estimate 
is left undetected and arises from an active ED, it can have a detrimental effect on the secrecy capacity 
if used in the subsequent downlink phase. Hence, the importance of effective detection schemes during 
channel estimation. 

An appealing and conceptually simple detection strategy that can be used during channel estimation, 
which we will also argue against, is to let the BS first estimate the mean power or large scale fading 
/3 of the estimated uplink channel vector gLU^ i-e-> /5 = IE[||gLu|P]- The value /3 changes slowly over 
time/frequency so that a good estimation of it is feasible. The instantaneous received energy of a pilot 
observation at the BS converges to fSP + Nq as M grows large, where P is the power of the pilot 
symbol and Nq is the noise density at the BS. Thus, if fi and Nq are known, the BS can compare the 
instantaneous received energy with /3P +Aq- In the absence of an active ED the two quantities are close 
to each other, while an active ED is detected if the instantaneous received energy is much larger than 
/3P + No- 

Unfortunately, there is a simple countermeasure that the ED can take. Since the value of fi changes 
slowly, the ED can adapt its transmit power in order to sabotage the estimation of /3 at the BS. The 
ED starts transmitting at low power, and increases the power over several coherence intervals of fi. The 
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ED is thereby emulating the natural change of the channel propagation environment, and the BS can 
not distinguish the increased received power from a natural channel quality improvement. The lesson 
learned from this example is that detection methods should not solely depend on the large scale fading 
parameter /3 and should preferably work without the knowledge of /3. This section will describe two 
different schemes (one with two flavours) that can effectively detect such an attack in MaMIMO systems 
without the knowledge of /?. Both schemes share two important features: simplicity and effectiveness, 
which are due to MaMIMO. Although ED’s presence during the channel estimation phase removes the 


expected MaMIMO gain in secrecy capacity, as demonstrated in section II-B MaMIMO instead enables 
simple and effective schemes for detection of the ED. 


A. Detection Scheme 1: LU transmits random pilot symbols 

This scheme exploits controlled randomness in transmitting “random” pilots to detect an active ED. 
As first proposed in ifTTll . the EU transmits a sequence of random phase-shift keying (PSK) symbols, 
which forms the key to detecting the ED at the BS. Below we discuss two variations of this scheme. 

1) Scheme la: Two pilot symbols pi and p 2 transmitted by the EU are chosen independently from an 
A^-PSK constellation. The BS receives the two pilot signals yi and y 2 . The BS now forms the detection 
statistic z as the phase of y^y 2 ^ where (.)^ is conjugate transpose. Three scenarios are possible: 

1) The ED is absent during both transmissions. In this case, the phase of z can be shown to converge 
to a phase of a valid PSK symbol as the number of antennas grows large. 

2) The ED is present in both slots. As the number of antennas grow large, the phase of z converges 
with probability 1 — 1/A^ to a number that is not a valid phase of an A^-PSK symbol. 

3) The ED is present in only one of the slots. In this case, 2 ; still converges to a valid PSK phase. 
However, the received power at the BS will be biased towards a larger value during the slot where 
the ED is present. Hence, one can form the ratio q = ||yi|P/||y 2 |P- If q < 71 or q > 72 , for some 
thresholds 71 , 72 , then it is decided that the ED is present. 

Erom 2), we know that as the antenna number M grows large, the probability of detection converges to 
1 — 1/N. Thus, it can be made arbitrarily close to 1 by increasing the alphabet size N while the false 
alarm probability converges to 0 due to 1). In order to use a large value of N, M must be quite large 
(M > 200). Note that this simple scheme is effective due to MaMIMO, which provides convergence of 
the scalar product to different values depending on ED’s presence. Moreover, for large M, this scheme 
is robust to knowledge of the noise power Nq. Namely, the noise is averaged out in the scalar product 
between the received signals when M is large. 
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2) Scheme lb: The second random pilot scheme provides improvements to the above scheme in case 
of three or more observations. Given L observations yi,..., y/,, form the matrices 


Y 

R 


[yi, • • • ,yL], 


Y^Y 

M 


iVoI, 


( 1 ) 


where I is an L x L identity matrix. When M becomes large, R converges to a rank-one matrix if ED is 
absent, otherwise it converges to a full rank matrix with probability 1 — 1/N. Based on this observation, 
the following detection rule is applied: if Ai{R}/A 2 {R} is greater than some threshold, ED is absent; 
otherwise it is present, where Ai{R} and A 2 {R} are the largest and the second largest eigenvalues of 

R. 


We will later see in section III-C that this scheme provides significant performance enhancement with 
only four observations. The scheme also takes care of the case when the ED is not present in all L slots. 
Again, noteworthy is the simplicity of this scheme, which is due to MaMIMO since it enables convergence 
of R to matrices of different rank depending on ED’s presence. Although performing significantly better 
than scheme la, scheme lb requires a good estimate of No, since it is used to construct R. 


B. Detection Scheme 2: Cooperative Detection Scheme 

The above random detection incurs the overhead of transmitting additional random sequences. We next 
briefly infroduce a defection mefhod fhaf does nof fransmif additional pilot symbols ifT^ . 

As illustrated in Eig. upon receiving the training signal from the EU, the BS can apply a beamformer 
based on the received signal, and then transmit a pilot to the EU using the same beamformer. The 
beamformer is constructed in such a way that the received sample at the EU in the absence of an active 
ED equals an agreed value (between the BS and the EU) after a scaling with 1/M. Eor simplicity, this 
agreed value can be taken as 1 in our discussion. In the case that there is an active ED, the EU will 
observe a much smaller quantity, and this forms our basis to detect the presence of the ED. 

As before, simple beamforming is effective due to MaMIMO. Similar to the random pilot scheme lb, 
the cooperative scheme also requires a decent estimate of Nq for proper performance. 


C. Comparison of Detection Schemes 

We discuss the pros and cons of the introduced detection schemes and show a comparison of detection 
performance in Eig. |^with 200 antennas at the BS. The channel vectors gLu and gEo are independent 
with each element drawn from a complex Gaussian distribution with mean 0 and variance 1. The pilot 
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powers from the LU and the ED are also equal. For the random pilot schemes, we use a QPSK alphabet. 
For the cooperative scheme, it is assumed that the noise power at the BS equals the noise power at the 
FU. 

As shown in Fig. the cooperative scheme performs best at moderate to high SNRs. The dotted curve 
illustrates the performance of random pilot scheme la. Its performance is inferior to the cooperative 
scheme at moderate to high SNRs, but significantly better at low SNRs. The dashed curve represents 
random pilot scheme lb with four received slots, which exhibits very good performance compared to the 
random pilot scheme with two slots. 

As depicted in Fig. the biggest advantage of the cooperative scheme is its detection performance 
during the two exchange intervals. The drawback with the cooperative scheme is that the ED can cause 
problems during the whole frame exchange. For example, the ED might be very close to the FU, and thus 
contaminate any packets that the FU receives from the BS. The noise power at the FU will therefore be 
significantly higher than the noise power at the BS, causing a degradation in the detection performance 
at the FU. 

The advantage of the random pilot schemes are their robustness to jamming of the FU by the ED, 
since the detection is performed at the BS. If the ED would increase its power toward the BS, it would 
instead result in yet easier detection of the ED. However, as illustrated in Fig.|^ the random pilot schemes 
requires more than two observations of the received signal in order to have a performance comparable 
or better than the cooperative scheme. 

IV. Further Discussions and Future Directions 

In this section, we discuss limitations of the solutions introduced above and give promising future 
directions. 

A. Limitations 

The reason why only the active attack is effective in MaMIMO is that the channels to the FU and 
the ED are assumed to be largely uncorrelated. If the channels were correlated, or in the worst case the 
same, then there is no need for the ED to be active. This means that if the ED can position itself such 
that its channel to the BS is highly correlated with the channel from the FU to the BS, then the ED can 
be passive. Furthermore, in line-of-sight scenarios the beamforming at the BS is directional. If the ED is 
at the very same angle-of-departure from the BS, the ED will receive a highly correlated signal although 
it may not be very close. We point out that this problem is alleviated in 3D beamforming scenarios. 
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These considerations are important to take into account in further work to delineate suitable scenarios 
for combining PLS with MaMIMO. 

B. Detection of Active Attacks in Multi-user and Multi-cell Systems 

We have so far been dealing solely with a single cell and a single user. The case of a multi-user scenario 
does not alter the situation much as the users can be allocated orthogonal resources for transmitting 
training symbols. Thus, there is virtually no interaction among users during the training phase. A multi¬ 
cell scenario, on the other hand, brings about radical changes. This is so since even without any active ED, 
the received signal at the BS corresponding to the LU’s training signal is being interfered with by LUs 
from other cells; this is the so called pilot contamination problem of massive MIMO 121. Consequently, in 
a multi-cell scenario, the problem of detecting the presence of an active ED changes into the much more 
challenging problem of distinguishing an active ED from EUs in other cells. In a multi-cell scenario, 
the detection methods from Section will all fail since they will detect the presence of the other cells’ 
EUs, but are not sophisticated enough to distinguish these from an active ED. 

The multi-cell active ED detection problem is a wide open research problem as, to the best of the 
authors’ knowledge, there are no attempts in the existing literature to deal with it. Although not much is 
known, we briefly introduce two potential ways forward that can be pursued in future research. 

1) Cooperative BSs: Cooperative BSs is a technology that has already found its way into the ETE 
standard, both in the form of the Coordinated Multipoint (CoMP) and as the less complex Network 
Assisted Interference Cancellation and Suppression (NAICS). In these architectures, the BSs of different 
cells are connected via a backhaul network and exchange information. Consequently, there is a possibility 
to let the BSs jointly estimate the level of EU-induced pilot contamination. Even better, the cooperative 
BSs can jointly try to minimize the pilot contamination in the system. Then the detection methods in 
Section can be applied verbatim. If the detection methods identify a suspiciously high level of pilot 
contamination, then the transmission can be terminated. In the case that there was in fact no active ED, 
but the EU-induced pilot contamination level was unusually high, the terminated transmission is not a 
major problem as the transmission is not very efficient whenever the pilot contamination is high. 

2) Methods based on radio propagation characteristics: In a multi-cell case, pilot contamination is 
caused by EUs from other cells. To be effective, the ED should arguably be located within the serving 
cell. The radio propagation characteristics between users and a MaMIMO BS are today well understood, 
and a reasonable working assumption is that the statistical properties of incoming radio waves to the BS 
from EUs far away are different from those coming from a potential ED that is located much closer to 
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the BS. This is so since signals from users in other cells are typically being reflected hy a few dominant 
objects in the vicinity of the users, and these objects may have line-of-sight to the serving cell BS. Thus, 
the radio waves’ angle-of-arrivals (AoAs) for users in other cells may be limited to a few possibilities, 
while the signal from a close by ED may reach the BS via interacting objects in the vicinity of the BS. 
This opens up a possibility to differentiate between pilot contamination from LUs and pilot contamination 
from an active ED. 

3) The angle-of-arrival database for location-aware users: A particularly interesting direction of 
research may be to combine the outlined approach in Section IV-B2 with the results from llTSl . In 
lfT3l . the authors discuss possibilities of systems where EUs can obtain position estimates of themselves. 
If the EUs report their positions and signal-strengths to a central node, then a database of signal strength 
as function of physical position can be constructed. In MaMIMO, this idea can be extended and utilized 
to detect active EDs. Rather than building a database of signal-strengths, a database can contain the 
AoAs to the BS from EUs at certain positions. The detection of an active ED would then comprise the 
following steps: (i) the EU reports his position to the BS , (ii) the EU transmits a training symbol, (iii) 
the BS requests the AoAs for the particular user position from the database, (iv) if the measured AoAs 
for the pilot observation does not match the input from the database, there is an active ED. So far, the 
authors are not aware of any attempt in the literature to build an AoA database, and future research is 
needed to investigate the feasibility of this approach. 

Again, if the ED can get physically close to the EU the measured AoAs may match those in the 
database even in the presence of an active ED . However, recent measurement campaigns ifT^ with 
a 128 port antenna array and where 8 users are located within a five-meter diameter circle show that 
the radio propagation characteristics are sufficiently different for the 8 users (both in line-of-sight and 
non-line-of-sight) so that they can all be spatially separated. This indicates that a MaMIMO system may 
very well be capable of distinguishing an ED from a EU even when they are physically close. 


C. Detection using Learning Mechanism 

Machine learning is a powerful tool that comes natural to mind for detecting active EDs. Machine 
learning comes in two forms: supervised and unsupervised learning. In supervised learning one must 
guarantee that there is no active ED present when training the machine. When this is not possible to 
guarantee unsupervised learning should be used. However, we can foresee a number of problems that arise 
that must be dealt with. Eirstly, a fairly large amount of training data must be used in machine learning, 
which may cause an unacceptably high overhead. In MaMIMO this is a particular severe problem as the 
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amount of training may grow with the antenna number. Secondly, the mobility of users is a problem 
since the channel quality and characteristics may vary dramatically over time and space. 

Alternatively, device dependent radio-metrics such as frequency and phase shift differences of radio 
signals can be used as unique fingerprints to detect active EDs ifTSl . This method is channel-invariant, 
but extracting the features is a complicated task. More efforts need to be made to resolve these problems 
in order to use machine learning tools for detecting active EDs. 

V. Conclusions 

MaMIMO has shown great potential to boost system capacity but the combination of PES and MaMIMO 
is not well understood yet. In this article, we have reviewed both attacks and detection schemes. In 
particular, we have shown that although passive eavesdropping has little effect on the secrecy capacity, 
an active attack on the channel estimation phase is harmful. We have presented three detection schemes 
that can effectively identify the active attack. The detection of active attacks in multi-cell and multi-user 
systems is especially relevant to the applications of MaMIMO - but is challenging and not much is known 
today. Some promising research directions to this end have been discussed in the paper. 
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Fig. 1: Left: A single-antenna passive ED in a single cell containing a single-antenna LU. Right: Example 
of secrecy capacity (length of the vertical line). The ED’s capacity Ced becomes independent of M. The 
secrecy capacity increases with M. 
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Fig. 2: Left: Active attack on the channel estimation. Right: The resulting channel capacities and the 
secrecy capacity. The ED’s training power is 10 dB weaker than the LU’s. 
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Fig. 3: Left: Detection scheme la. LU first transmits two random PSK symbols. After processing at the 
BS side, the correlation of the two received signals should (roughly) be a valid PSK symbol if there is 
no active ED present. Notice that case 3 is not covered in the figure. Right: Detection scheme lb. LU 
transmits (in this case) four random PSK symbols. The BS constructs a correlation matrix, and performs 
a test based on the ratio of the two largest eigenvalues of the matrix. 
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Fig. 4: Overview of Detection scheme 2. In phase 1, the BS performs channel estimation. In the next 
phase, the BS applies a specialized heamformer (see |[T^ ) which ensures that the received signal at the 
LU after processing becomes 1. If a smaller quantity is observed, there is an active ED present. 
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Fig. 5: Comparison of the discussed detection schemes. The false alarm prohahility is 1% in all schemes. 
The random pilot schemes use random QPSK pilots. 
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